Write documentation on how to set up /etc/containers/policy.json

[lubosmj]

Signed content is not possible to verify unless there are additional changes to the policy configuration made.

A user who consumes content from the Pulp Registry needs to update the policy (maybe) for each repository separately in order to let podman succeed with the pull operation, like so:

           "localhost:24817/my_precious": [
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release",
                    "signedIdentity": {
                        "type": "remapIdentity",
                        "prefix": "localhost:24817/my_precious",
                        "signedPrefix": "registry.redhat.io/ubi8/ubi-micro"
                    }
                }
            ],

This has to be properly documented to avoid possible confusion about invalid signatures.

[goosemania]

Additional note: If user makes the base_path of a distribution the same as the repo name in the remote registry, then no configuration per repo will be needed and it could be just registry name remapping:

           "localhost:24817": [
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release",
                    "signedIdentity": {
                        "type": "remapIdentity",
                        "prefix": "localhost:24817",
                        "signedPrefix": "registry.redhat.io"
                    }
                }
            ],

[ipanova]

I would not expand much in our docs on how to setup the policy file since in the specs it is outlined quite well. We can provide some basic example to get user started and for the rest point to the specs.

[goosemania]

I would not expand much in our docs on how to setup the policy file since in the specs it is outlined quite well. We can provide some basic example to get user started and for the rest point to the specs.

I think it makes sense to provide specific examples for what will work with pulp use cases. As a user, I would get lost in terminology between docker, policy and pulp. E.g. A repo(?) name in registry is a base_path in pulp and if you make them the same, it will make your policy maintenance much lighter. My head has already exploded 🤯